300-215 Question 189
Select 3During an investigation, a security analyst identifies a suspicious file on a system. The file has an unusual extension and was flagged by endpoint protection software. What should the analyst recommend as the next steps to evaluate the file based on its characteristics?
- A
Perform a hash calculation and compare it against known malicious file hashes in threat intelligence databases.
- B
Upload the file directly to a public malware sandbox for immediate analysis.
- C
Review the file’s metadata and creation timestamps to identify anomalies or inconsistencies.
- D
Analyze the file’s behavior in a secure, isolated environment to observe any malicious activity.
- E
Delete the file immediately to prevent potential harm to the system.
Show answer and explanation
Correct answers: A, C, D
Explanation
Evaluating files based on their characteristics involves a methodical approach that includes comparing the file's hash to known malicious hashes, examining metadata for anomalies, and analyzing the file in a controlled environment. These steps provide a comprehensive understanding of the file's nature without prematurely deleting potentially critical evidence or exposing organizational data to risk.
- A. Correct.
Performing a hash calculation and comparing it against known malicious file hashes is a critical step in identifying whether the file matches known threats.
- B. Incorrect.
Uploading the file to a public malware sandbox poses risks of exposing sensitive organizational data and should not be done without proper consideration.
- C. Correct.
Reviewing the file’s metadata and timestamps can help in identifying unusual patterns or signs of tampering, which may indicate malicious intent.
- D. Correct.
Analyzing the file’s behavior in a secure, isolated environment allows the analyst to observe any harmful activities without risking the production environment.
- E. Incorrect.
Deleting the file immediately is not recommended as it could hinder a thorough investigation and prevent further analysis of potential threats.